Dynamic system and method for identifying optimal servers in a virtual private network

ABSTRACT

A request for a virtual private network (VPN) server that is an optimal VPN server for a user device is received. Respective penalty scores for VPN servers including the optimal VPN server are calculated. A respective penalty score of a VPN server is calculated based on whether the VPN server is in a same country as the user device and a proximity of the VPN server to an international Internet exchange hub. The optimal VPN is server is selected based on the respective penalty scores. An internet protocol (IP) address of the optimal VPN server is transmitted to the user device.

TECHNICAL FIELD

The present invention relates generally to virtual private networks(VPN), and more particularly to identifying optimal servers in a VPN.

BACKGROUND

Global Internet users increasingly rely on virtual private network (VPN)services to preserve their privacy, circumvent censorship, and accessgeo filtered content. Originally developed as a technology to privatelysend and receive data across public networks, VPNs are now used broadlyas a privacy-preserving technology that allows Internet users to obscurenot only their traffic but also their personal information, such astheir web browsing history, from third parties including Internetservice providers (ISPs) and Spywares, etc. A VPN service provideroffers a secure private networking environment within a shared publicinsecure infrastructure through encapsulation and encryption of alltraffic from the VPN application within the VPN user's device lo theremote access VPN server.

Most VPN providers rely on tunneling protocol to create a privatenetwork to add a layer of security that protects each packet on itsjourney over the Internet. Tunneling is the process of placing theentire packet within another packet before it is transported over theinternet. The outer packet protects the contents from public view andensures that the packet moves within a virtual tunnel. This virtualtunnel is a point-to-point tunnel established between the user deviceand the VPN server. This layering of packets is called encapsulation.Computers or other network devices at both ends of the tunnel. calledtunnel interfaces, can encapsulate outgoing packets and reopen incomingpackets. Additionally, in a VPN network, devices at each end of thetunnel encrypt the data entering the tunnel and decrypt them at thedestination.

Encryption is the process of changing the data from a transparentlyreadable format to an encoded, unreadable format with the help of anencryption algorithm. This encoded format can only be decoded with theright decryption key. VPN encryption, as mentioned before, renders theuser's online traffic indecipherable to any third-party monitoring them.At the fundamental level, when a user launches a VPN application andconnects to a VPN server, all the subsequent user's requests areencrypted before they are sent to the server. Then they are decrypted bythe server and forwarded to the intended target on the Internet. Afterwhich the requested data is encrypted when the server receives them andsends the received data back to the user device. Once the data reachesthe user device, the data is decrypted by the VPN application so thatthe user can view them.

VPNs generally use different types of encryption algorithms to encryptand decrypt user's online traffic. Symmetric encryption is one of thealgorithms that rely on the identical public key and private key. Thisform of encryption is considered relatively fast, and one example ofsymmetric encryption is the AES encryption cipher. Another type ofencryption algorithm is the Asymmetric encryption; it is also known aspublic key cryptography. This algorithm uses different keys for theencryption and decryption process. An example of asymmetric encryptionis the RSA (Rivest-Shamir-Adleman) protocol.

VPN encryption keys are a randomly generated string of bits that is usedto encrypt and decrypt data. Each encryption key is generated in such away that it is unique. The length of an encryption key is calculated inbits, and usually, the longer the key is, the stronger the keyencryption. There are two types of encryption keys that are beingused—Private key and Public key. They are mathematically related, sinceany kind of information that is encrypted with a public key can only bedecrypted with a private key associated with it. The public key isusually available through a public directory, while the private keyremains confidential and is only accessible by the key owner.

When a user accesses a VPN client application, the user is first takenthrough the procedure of authentication. User authentication is theverification of credentials required for confirmation of a user'sauthenticity. In other words, authentication is used to prove a user isallowed access, and so provides a form of access control. A typical userauthentication consists of verifying a simple ID and passwordcombination. However, more authentication factors are added to improvethe security of the VPN user. The primary authentication factors areknowledge, possession and inherence. Knowledge factors include allthings a user must know in order to log in to the VPN clientapplication, e.g., usernames or ID, passwords and PINs. In the same way,possession factors consist of anything a user must have in theirpossession, such as one-time password (OTP) tokens. Finally, theinherence factors include any inherent trait the user has that areconfirmed for accessing the VPN client application such as fingerprintscans, retina scans, iris scans, etc.

A typical VPN service consists of a network of servers, typically spreadacross several geographical locations. VPN server is a physical or avirtual server that is configured to host and deliver VPN services tousers worldwide. The server is a combination of hardware and VPN serverusually has more logical and physical communication ports. The VPNclient application connects with a VPN server and sends the user'straffic to it through an encrypted tunnel. After receiving all theencrypted traffic, the VPN server will decrypt and forward the trafficto the designated web server. As soon as the web server sends therequested data, the VPN server receives and encrypts the data beforesending it to the user. The VPN client application will then decrypt thedata for the user's view.

A VPN client application is a software-based technology that establishesa secure connection between the user and a VPN server. Some VPN clientapplications work in the background of the user's device automatically,while others have front-end interfaces that allow users to interact withand configure them. VPN client applications are often installed on acomputer, though some organizations provide a purpose-built VPN clientapplication that is a hardware device pre-installed with VPN software.Generally, VPN client applications operate on more than one VPN protocolto encrypt and decrypt the data. Some of the commonly used VPN protocolsare OpenVPN, SSTP, PPTP, L2TP/IPSec, IKEv2, SoftEther

Most of the VPN services allow users to select or switch betweendifferent servers in the private network according to the user's choiceof location or requirements. For instance, if a user wants to connect toa VPN server that is located in the US, the user can simply choose thelocation through the graphic user interface and the connection will beinstantly established to the US server. It is also the same when theuser wants to switch to a different server in that particular country.The existence of multiple servers in a VPN service network makes itpossible for users to choose the location of servers. Without thisprovision of choice, users generally will be assigned random serverswithout the ability to choose the servers with certain parameters thatthey want. The more VPN servers a VPN service provides, the better it isfor the users. This is because the users will have more servers tochoose, and they can access even the remotest websites that are onlyavailable in certain countries.

However, most VPN services do not have an inbuilt system or a method torecommend or identify an optimal server for a particular user from theVPN Servers available. Average users often do not have clarity foridentifying and selecting the optimum server to serve their purpose.Therefore, users mostly tend to randomly choose a server in a VPNservice provider without weighing the servers' various parameters andconditions. Without evaluating the server conditions, the user is leftin ambiguity while choosing a random server. One cannot be assured thatall servers in a VPN service can be ideal so, it is important for theVPN service provider to evaluate and recommend servers to usersaccessing their services. This ensures reliability, connectivity, andimproves user experience significantly.

Not all servers in a VPN network are suitable for servicing the user. Insome instances, there can be poor connectivity between the chosen serverand the user device; there can be occasional lag or other difficultieswhen connected with a certain server in a VPN network. These impedimentsin a VPN network are due to various unavoidable factors that tend toaffect VPN servers' performance. Therefore, a VPN service provider mustanalyze and evaluate the server conditions before servicing the user.Moreover, the server conditions can be volatile over time and must bemonitored at regular intervals.

For instance, location can be an important condition in evaluating aserver for a particular connection request. If the chosen server issignificantly far from the user's actual location, then there arechances of poor connectivity and lower server speed. The reduction inthe server speed correlates to how far the connection must travel sincechances of packet losses also rise with the longer server distance,which reduces the network speed. Other than location, load of a servercan also be another condition in evaluating the servers. A server loadis the amount of total server bandwidth currently being used and itdirectly correlates to the number of users sharing the server at once.Overloading of servers in a VPN network is the most common reason forexperiencing lag or poor connectivity. When numerous users areconnecting with the same server simultaneously, there is a chance forthe particular server to overload with plenty of requests, affecting theserver performance. Availability of fewer servers in a given location isone reason for overloading, due to the lack of choice for the userswhich makes it impossible to distribute the users' request load acrossmultiple VPN servers.

Apart from the distance of a server and overloading, if the chosen VPNserver is not located on or not in proximity with an internationalInternet exchange hub, then there are chances for slower network speed.Servers that are in close proximity to an international Internetexchange hub have significant server speed, and all connections thatpass through these exchange hubs are faster. The better speed andconnectivity are because of how international Internet cables are laid.For instance, if a user intends to connect with servers in the UK andchooses servers in Manchester over London due to the US's distanceproximity, the user may experience lag or reduced server speed. BecauseLondon is one of the exchange hubs on the international Internetexchange hub and all connections to Manchester pass through London.Therefore, all connections to London servers tend to be faster comparedto other locations that are considerably far away from the internationalInternet exchange hub. For that reason, it will be beneficial to developsystems and methods to identify servers that are in proximity to anInternational internet hub so that potential lag and network problemscan be avoided.

Several other conditions render specific servers suitable or not sosuitable for servicing the user. Therefore, the VPN service providermust develop methods or systems to evaluate conditions pertaining toseveral VPN Servers to efficiently service their users. Identifying andrecommending an optimal server from among the given set of VPN serverscan improve server response time, data throughput and overall userexperience. To address this issue, the current embodiment providessystems and methods to dynamically evaluate, identify, and connect theuser with an optimal server from among a given set of VPN Servers.

SUMMARY

The present embodiment provides systems and methods to effectivelyidentify and service the user's request through an optimal server fromamong multiple VPN servers. In one aspect, the present embodiment cangather data, compute, analyze and determine several factors andconditions related to multiple VPN servers present in a VPN serviceprovider's infrastructure. The embodiment is able to compute serverpenalty scores for multiple VPN servers using their correspondingnumerical weights. The current embodiment also can calculate numericalweights for each server conditions corresponding to multiple VPNservers.

Another feature of the embodiment includes choosing the optimal VPNserver consistently and dynamically from a scored list of VPN servers.The chosen optimal server is then employed to service the user requestseffectively. The method includes identifying a VPN server with thelowest penalty score since the lowest penalty score is an indicator ofthe optimal VPN server. The VPN server with the lowest penalty score ischosen by the embodiment and is able to instruct the VPN clientapplication to establish an encrypted connection between the chosen VPNserver and the user device. Furthermore, the embodiment can calculateand determine a small value known as the random value, which is utilizedin the computation of server penalty score. The random value is anumerical value which has a range of [0, 0.001]. The seed forcalculating this random value can be generated by combining multipleattributes, server conditions, and other properties. The term seedrefers to the numerical value that is generated using one or morevalues. Exemplary combinations for the random value seed may include andnot limited to server IDs, Unix time value rounded to the nearestdesired interval, client application IDs. The client application ID hererefers to a randomly generated number during the installation of the VPNclient application in the user device. The purpose of this random valueis to ensure that no two servers will have the same server penalty scorein a given set of VPN servers.

Another aspect of the current embodiment includes a server pickerinfrastructure for choosing the optimal VPN server from multiple VPNservers. The server picker infrastructure can dynamically compute anddetermine server penalty scores for each VPN server. The server pickerinfrastructure is also configured to gather multiple server conditionsfor computing server penalty scores. Some examples of gatheredinformation regarding server conditions are server location, hub score,current load, bandwidth, server creation time, server IDs etc. Theembodiment includes systems and methods to measure these conditions anddetermine numerical weights for the multiple server conditions. Anotherfeature of the embodiment is that it includes methods and systems todetermine hub scores for multiple VPN servers based on their proximityto the international Internet exchange hub. The hub score is determinedand assigned through one of the embodiments and is used to identify theproximity of multiple VPN servers with international Internet exchangehubs. Moreover, the system is configured to regularly measure theseconditions and update the server penalty scores for each VPN server.

Another aspect is a method that includes receiving a request for avirtual private network (VPN) server that is an optimal VPN server for auser device; calculating respective penalty scores for VPN serversincluding the optimal VPN server, where a respective penalty score of aVPN server is calculated based on whether the VPN server is in a samecountry as the user device and a proximity of the VPN server to aninternational Internet exchange hub; selecting the optimal VPN serverbased on the respective penalty scores; and transmitting an internetprotocol (IP) address of the optimal VPN server to the user device.

Another aspect is a method that includes receiving a request for avirtual private network (VPN) server that is an optimal VPN server for auser device; calculating respective penalty scores for VPN serversincluding the optimal VPN server, where a respective penalty score of aVPN server is calculated based on a creation time of the server;selecting the optimal VPN server based on the respective penalty scores;and transmitting an internet protocol (IP) address of the optimal VPNserver to the user device.

Another aspect is a device that includes a memory and a processor. Theprocessor is configured to execute instructions stored in the memory toreceive a request for a virtual private network (VPN) server that is anoptimal VPN server for a user device; calculate respective penaltyscores for VPN servers including the optimal VPN server, where arespective penalty score of a VPN server is calculated based on whetherthe VPN server is in a same country as the user device and a proximityof the VPN server to an international Internet exchange hub; select theoptimal VPN server based on the respective penalty scores; and transmitan internet protocol (IP) address of the optimal VPN server to the userdevice.

BRIEF DESCRIPTION OF THE DRAWINGS

The disclosure is best understood from the following detaileddescription when read in conjunction with the accompanying drawings. Itis emphasized that, according to common practice, the various featuresof the drawings are not to-scale. On the contrary, the dimensions of thevarious features are arbitrarily expanded or reduced for clarity.

FIG. 1 shows a block diagram of an exemplary architectural depiction ofcomponents.

FIG. 2A shows an exemplary flow diagram of the operations of identifyingan optimal server.

FIG. 2B is a continuation diagram showing an exemplary flow diagram ofthe operations of identifying an optimal server.

FIG. 3 shows a computing system in which a computer readable medium mayprovide instructions for performing any of the methods and processesdisclosed herein.

DETAILED DESCRIPTION

Some general terminology descriptions may be helpful and are includedherein for convenience and are intended to be interpreted in thebroadest possible interpretation. Elements that are not imperativelydefined in the description and should have the meaning as would beunderstood by the person skilled in the art.

User Device 102—can be any computing device capable of hosting the VPNclient application. It can comprise any physical device that isconnected to a network, including, for example, a laptop, a mobilephone, a tablet computer, a desktop computer, a smart device, a routerand other network devices. User Device 102 can also be a device that iscapable of network connectivity, but not primarily intended fornetworking, such as connected home appliances, smart home securitysystems, autonomous farming equipment, wearable health monitors, smartfactory equipment, wireless inventory trackers, biometric cybersecurityscanners, and others.

VPN Service Provider Infrastructure 104—is a combination of hardware andsoftware that provides functionality for multiple User Devices 102 viathe Network 122. VPN Service Provider Infrastructure 104 can receivefrom the User Device 102 the request to establish a VPN connection andalso can forward the IP addresses of the optimal servers along withauthentication credentials for the purpose of establishing the encryptedtunnel to the User Device 102. Specifically, VPN Service ProviderInfrastructure 104 may contain the Server Picker Infrastructure 110which is responsible for identifying the optimal server through in-builtalgorithms and computations. The VPN Service Provider Infrastructure 104also contains databases, which will persistently store and contain allof the data necessary for servicing the VPN client. In some instances ofthe embodiment the VPN Service Provider Infrastructure 104 includes theTesting Module 118 that gathers information related to the plurality ofVPN Servers 120. VPN service Provider Infrastructure 104 can be acombination of physical devices, virtual machines/servers, or can belocated on the cloud.

API 106—where API is an acronym for application programming interface.API 106 is a programming interface consisting of one or more endpointsto a defined request-response message system. In simple terms, API 106is the interface between the User Device 102 and the VPN ServiceProvider Infrastructure 104. API 106 is capable of handling theauthentication requests from the User Device 102 and also mediating therequests for establishing a VPN connection. API 106 is a constituent ofVPN Service Provider Infrastructure 104 and it can request the ServerPicker Infrastructure 110 for the IP addresses of optimal VPN servers.It can also send a database query to the User Database 108 in order toauthenticate the User Device 102. API 106 can be operating on anyhardware or can be based on cloud.

User Database 108—a component of the VPN Service Provider Infrastructure104 and a structured repository of authentication credentials belongingto the owners of multiple User Devices 102. It stores user related datain tables (named columns and multiple rows), where there is informationincluded regarding the authentication credentials of the owner of UserDevice 108. It is responsible for verifying credentials of the owner ofthe User Device 102 and allowing the User Device 102 to connect with theVPN Service Provider Infrastructure 104. User Database 108 can bepopulated with user profiles continuously and is responsible forauthenticating, authorizing multiple User Devices 102. User Database 108can be any physical storage device or a cloud-based storage.

Server Picker Infrastructure 110—a logical unit and a constituent of theVPN Service Provider Infrastructure 104 that is configured to performcomplex operations of identifying the optimal server from among theplurality of VPN Servers 120. Server Picker Infrastructure 110 iscapable of querying Server Database 116 for server data which is usedfor computing server penalty score. It also communicates and providesdata to User Device 102 through API 106 concerning the identifiedoptimal server. It is a more complex unit consisting or in combinationof Scoring Engine 112 and Processing Unit 114. It can be a combinationof software and hardware present within or in combination with the VPNService Provider Infrastructure 104 but the direction of interactionswith VPN Service Provider Infrastructure 104 and its constituentsremains unchanged.

Scoring Engine 112—a component within or in combination with the ServerPicker Infrastructure 110 that is configured to manage, performarithmetical and logical operations for calculating the server penaltyscore for the plurality of VPN Server 120. The Processing Unit 112 canbe a combination of software and hardware and is capable of identifying,and returning the IP address of the optimal server to API 106 through aseries of analytical operations.

Processing Unit 114—a logical component within or in combination withthe Server Picker Infrastructure 110 that is configured to performcomplex operations of computing numerical weights of various serverconditions. Processing Unit 114 may also contain an internal storageunit at its disposal and can be a combination of hardware and software.

Server Database 116—a component of the VPN Service ProviderInfrastructure 104 and a storage unit for storing server conditionscollected by the Testing Module 118. Server conditions can include butnot limited to location, load, time of creation, hub score, server IDs,etc. of the plurality of VPN Servers 120. Server Database 116 can be acombination of hardware and software or a cloud-based system that offersa database management system.

Testing Module 118—is a processing unit that gathers several informationabout the plurality of VPN Servers 120 known as the server conditions.Testing Module 118 is capable of performing tests against individual VPNservers 120 in order to gather information related to speed, load, roundtime, etc. It gathers several information on server conditions and isalso capable of determining hub score for the plurality of VPN Servers120. In some instances of the embodiment, Testing Module 118 and ServerDatabase 116 can be located in a separate system present within or incombination with the VPN Service Provider Infrastructure 104.

VPN Servers; VPN Server 1; VPN Server 2; VPN Server n 120—are exemplaryinstances of the plurality of VPN Servers. Here, VPN is an acronym forvirtual private network. The number of servers in the plurality of VPNServers 120 are not limited and depend on the VPN network provider'sinfrastructure. A VPN Server is a physical or virtual server that isprovisioned to host and deliver VPN Services to multiple User Devices102 worldwide. Each of the servers in the plurality of VPN Servers 120is a combination of VPN hardware and VPN software that allows a VPNclient installed on the User Device 102 to connect to a secure privatenetwork. VPN Servers 120 usually contains more logical and physicalcommunication ports.

Network 122—is a digital telecommunications network that allows nodes toshare and access resources. Examples of a network: local-area networks(LANs), wide-area networks (WANs), campus-area networks (CANs),metropolitan-area networks (MANs), home-area networks (HANs), Intranet,Extranet, Internetwork, Internet.

Optimal Server—is a VPN server among the plurality of VPN servers thathas the least server penalty score and is chosen by the Server PickerInfrastructure 110 as the optimal one or in other words as the bestavailable server from among the plurality of VPN Servers 120 toestablish VPN connection with the User Device 102.

Server penalty score—a numerical indicator that infers the quality andcondition of a particular server. The server penalty score is calculatedby using numerical weights which are direct numerical representations ofvarious server conditions.

Numerical weights—a numerical representation of multiple serverconditions. Numerical weights are calculated through the internalalgorithm of the Processing Unit 114 that includes various arithmeticoperations and formulae. The internal algorithm here refers to multipleformulary arithmetic operations performed by the Processing Unit 114.Each server condition has its corresponding numerical weights calculatedby the Processing Unit 114.

Random value—a numerical value that is calculated by the Scoring Engine112 using the random value seed. The random value seed refers to thenumerical value that is generated using one or more values. For example,server ID, client application ID, Unix time value are some of theexemplary sets of values that are used to generate the seed forcalculating the random value.

Unix time format—is a data-time format used to express the number ofmilliseconds that have elapsed since Jan. 1, 1970 00:00:00. It consistsof two layers of encoding in which the first layer encodes a point intime as a scalar real number and the second layer encodes the scalarreal number as a sequence of bits or decimal digits.

Hub score—a numerical value determined and assigned to the plurality ofVPN Servers 120 by the Testing Module 118. The hub score is determinedbased on a VPN server's proximity to an international Internet exchangehub. Usually, zero or minimal value indicates that a particular VPNserver is considerably closer to an international Internet exchange hub.

International Internet exchange hub—a physical infrastructure throughwhich Internet service providers exchange Internet traffic between theirnetworks. The primary purpose of an international Internet exchange hubis to allow networks to interconnect directly, via the exchange, ratherthan through one or more third-party networks. The primary advantages ofdirect interconnection are cost, latency, and bandwidth.

FIG. 1 shows an exemplary overall architecture of the current embodimentthat comprises User Device 102, which can be any computing or networkingdevice (e.g., a personal computer, mobile phone, a tablet computer,router, smart home device) having access to a particular network (e.g.,Internet) and to a VPN application, a VPN Service ProviderInfrastructure 104, plurality of VPN Servers 120. All the mentionedcomponents of the embodiments have access to Network 122 and are able tointeract with each other through the same. Here, Network 122 can be anydigital telecommunication network that permits several nodes to shareand access resources, e.g., local-area network (LAN), wide-area networks(WANs), campus-area networks (CANs), metropolitan-area networks (MANs),home-area networks (HANs), Intranet, Extranet, Internetwork, Internet.The VPN Service Provider Infrastructure 104 consists of the followingcomponents: API 106, User Database 108, Server Picker Infrastructure110, Testing Module 118, and Server Database 116. The Server PickerInfrastructure 110 in turn consist of the following components: ScoringEngine 112 and Processing Unit 114. The VPN Server 1 120, VPN Server 2120, VPN Server n 120 represents the plurality of VPN Servers present inthe VPN network. In other words, each server in the plurality of the VPNServers 120 is provisioned to perform the same task as any other VPNServer 120, but can be spread out geographically. While the elementsshown in FIG. 1 implement the exemplary embodiment, some elements inother embodiments can have different titles or can be combined into asingle element instead of two separate elements (for example, ScoringEngine 112 and Processing Unit 114 can be combined into a singlehardware, software infrastructure to form a single logical unit.Likewise, Testing Module 118 and Server Database 116 can also becombined into a single hardware, software infrastructure or can becombined into a single unit on a cloud.) However, the functionality ofelements and the flow of information between the elements is notimpacted generally by such consolidations or combinations. Therefore,FIG. 1 as shown should be exemplary only, and not restrictive orexclusionary of other features, including features discussed in otherareas of this disclosure here within.

In FIG. 1, all occurrences of communication between the User Device 102,VPN Service Provider infrastructure 104 and the plurality of VPN servers120 occur through the Network 122. The instances of communicationbetween User Device 102 and VPN Service Provider Infrastructure 104include but are not limited to authentication, authorization, dataexchange, etc. The communication instances between User Device 102 andthe plurality of VPN Servers 120 can happen through an encryptedtunneling protocol provided by the VPN application installed on the UserDevice 102. The tunneling protocols can include but not limited to PPTP,SSTP, L2TP/IPSec, OpenVPN, SSTP, IKEv2, SSL/TLS, Wireguard.

With reference to FIG. 1, the API 106 receives the User Device's 102request via the Network 122, and the request can be either anauthentication request or a request for the IP address of an optimalserver in order to establish a VPN connection. Initially, when the UserDevice 102 approaches the VPN Service Provider Infrastructure 104, thefirst request is usually an authentication request. Valid credentialsare provided by the User Device 102 for the purpose of authentication,which is then verified by the API 106 by accessing the User Database108. The API 106 queries the User Database 108 for verifying thecredentials provided by the User Device 102 against the data present inthe User Database 108. Once the credentials are validated, the API 106authenticates and authorizes the User Device 102.

After authentication, the User Device 102 requests the API 106 for theIP address of an optimal server in order to establish a VPN connection.To satisfy the request, the API 106 in turn requests the Server PickerInfrastructure 110 for an optimal server. The Server PickerInfrastructure 110 is responsible for identifying the optimal serverfrom the plurality of VPN Servers 120. Through a series of in-builtmethods and/or systems, the Server Picker Infrastructure 110 is able toidentify the optimal server. In particular, the Server PickingInfrastructure identifies an optimal server by calculating serverpenalty score for the plurality of VPN Servers 120. The server penaltyscore is based on multiple server conditions obtained through theTesting Module 118. The Scoring Engine 112 proceeds to calculate theserver penalty score by using the numerical weights provided by theProcessing Unit 114, and the random value for each of the plurality ofVPN Servers 120 calculated by the Scoring Engine 112. The random valueis a numerical value in the interval [0, 0.001]. Addition of this smallvalue to the server penalty score calculation ensures that each score isdifferent and avoids coincidences of server penalty score values.

The IP addresses of the plurality of VPN Servers 120 are arranged in anascending order according to their respective server penalty score. TheScoring Engine then identifies the optimal server by choosing the serverwith the lowest penalty score. After which, the Scoring Engine 112returns the IP address of the identified optimal server to the API 106.The User Device 102 receives the IP address of the identified optimalserver through the API 106, after which the User Device 102 makes asecure connection with the optimal server identified by the ScoringEngine 112. The Scoring Engine 112 and the Processing Unit 114 includerespective internal storage unit or an internal memory capable ofstoring, arranging, and sequencing data.

The Server Database 118 and the User Database 108 can be conventionaldatabases offered by MySQL, MSSQL, NoSQL, object-oriented databases, orany other type or category of databases. Data storage-wise the ServerDatabase 118 can also be a data storage within the memory of a computingdevice or within a cloud. Server Database 118 is responsible forstoring, organizing, and returning data related to the plurality of VPNServers 120. Similarly, the User Database 108 is responsible forstoring, and returning authentication credentials of User Device 102accessing the VPN Service Provider Infrastructure 104. Informationregarding the plurality of VPN Servers 120 are stored in the ServerDatabase for the purpose of penalty score calculation.

All requests from the User Device 102 in the current embodiment areexecuted through a VPN application installed locally or remotely,launched locally or as a remote application. This VPN application, alsocalled the VPN client, is a software-based technology that establishes asecure connection between the User Device 102 and a VPN Server. VPNapplications can include a front-end interface that allows the UserDevice 102 to interact and configure it. In some cases, a VPNapplication can be a standalone purpose-built device, or a standardcomputing or networking device installed and configured with the VPNapplication software.

Further, in FIG. 1, the Testing Module 118 is responsible for collectingthe information related to multiple server conditions including but notlimited to geo-location of servers, IP addresses of servers, location ofservers with respect to the international internet exchange hub,creation time of servers, load measurements of servers, etc. The TestingModule 118 can determine hub score for each server in the plurality ofVPN Servers 120 based on their proximity to the international Internetexchange hub. Hub scores are assigned by the Testing Module 118 andindicates the proximity of a server to the international internetexchange hub. Higher hub score indicates that a server is significantlyfar from an international Internet exchange hub and vice versa.Furthermore, Testing Module 118 is also able to monitor and measure theload of a particular server at regular time intervals and can update theload measurements in the Server Database 116. All the necessaryinformation regarding the server conditions are populated into theServer Database 116 by the Testing Module 118 which are then laterutilized by the Server Picker Infrastructure 110.

The embodiments described herein enable effectively establishing a VPNconnection between the User Device 102 and an optimal server from amongthe plurality of VPN Servers 120. According to an embodiment, an optimalserver is identified through producing a list of the plurality of VPNServers 120 which is arranged according to their server penalty score,beginning with the least score value. The server with the least penaltyscore value is considered to be the optimal server.

According to an embodiment, the plurality of VPN Servers 120 areconstantly updated and rearranged within the suggested list of VPNServers 120 according to their server penalty scores, with the lowestscore value always at the top, enabling a dynamic and effective systemand method to identify the optimal server from the list of scored VPNServers 120.

Another feature of the disclosed embodiments includes computing serverpenalty score for the plurality of VPN Servers 120. The server penaltyscore is an indicator of the suitability of a particular server forservicing the User Device 102. First numerical weights for the pluralityof VPN Servers 120 are computed based on their server conditions.Multiple server conditions of an individual server are representednumerically through the calculations of numerical weights. Using thesenumerical weights, the server penalty score for each server present inthe plurality of VPN Servers 120 is determined and computed.

Another feature of the current embodiments is that they contain systemsand methods to access the Server Database 116 that contains informationrelated to several server conditions gathered by the Testing Module 118.The Server Database 116 and the Testing Module 118 can be either inbuiltor in combination with the current embodiment. The Testing Modulepresent in FIG. 1 of the current embodiment is responsible to gatherinformation relating to several server conditions of the plurality ofVPN Servers 120.

The following figures illustrate the above-mentioned processes and thevarious embodiments involved with more technical detail. FIGS. 2A and 2Bdepicts the exemplary flow diagram of the current embodiment. The UserDevice 102 before accessing the optimal server from among the pluralityof VPN servers 102, must authenticate itself with the VPN ServiceProvider 102. One must note that the process of authentication may notbe an exclusive part of the embodiment, but it is a foundational step orin other words an initial procedure to access the services of thecurrent embodiment by the User Device 102.

In step 201, the User Device 102 with the VPN application initiates toauthenticate itself with the VPN Service Provider Infrastructure 104 viathe Network 122. This request to authenticate is handled by the API 106of the VPN Service Provider Infrastructure 104 which receives thecredentials provided by the User Device 102. The API 106 in step 203,queries the User Database 108 and verifies the credentials provided bythe User Device 102 against the data existing in the User Database 108.Once the verification is successful, the API 106 authenticates the UserDevice 102 in step 205. The authentication process may involve verifyingthe combination of the user ID and password or PIN provided by the ownerof the User Device 102. Verification of OTP (one time password) tokensor biometric traits can also be involved in the process ofauthentication. The authentication process is important because itenables the VPN Service Provider Infrastructure 104 to keep its networkssecure by permitting only authenticated User Devices 102 to access itssecured services. Once authenticated, the User Device 102 is usuallysubjected to an authorization process as well, to determine whether theauthenticated User Device 102 should be permitted further access to theVPN Services. The terms authentication and authorization are often usedinterchangeably. While they may often be implemented together, the twofunctions are distinct. Authentication is the process of validating theidentity of a connecting user behind the User Device 102 before allowingaccess to the VPN services, whereas authorization on the other hand isthe process of validating whether the authenticated User Device 102 hasbeen granted permission to access the requested services. Theauthentication process is a prerequisite for the authorization processto happen.

After authentication is successful. in step 207 the User Device 102requests for the IP address of a VPN server to establish a VPNconnection. This request for the IP address is received by the API 106which is responsible for handling such requests. The API 106 in step 209recognizes this request of the User Device 102 and further requests forthe IP address of an optimal server from the Scoring engine 112 of theServer Picker Infrastructure 110.

Responding to the request from API 106, the Scoring Engine 112 begins tocalculate the server penalty score for the plurality of VPN servers 120.For this, the Scoring Engine 112 requires numerical weights that arecomputed by the Processing Unit 114 based on multiple server conditions.In step 211 the Scoring Engine instantaneously requests for numericalweights from the Processing Unit 114. As defined above, the ProcessingUnit 114 is a logical unit that is capable of performing arithmeticaland logical operations in order to calculate the numerical weights.Numerical weights can also be roughly termed as sub scores that arecalculated for each server condition by converting them intomathematical expressions. The mathematical expressions and the formularyarithmetic operations used for calculating the numerical weights arecollectively termed as the internal algorithm of the Processing Unit114.

Once the request is received by the Processing Unit 114, in step 213 itsends a query to the Server Database 116 containing all necessaryinformation on server conditions relating to the plurality of VPNServers 120. The Server Database 116 contains data related to serverconditions such as server location, server hub score, server time ofcreation and server load for the plurality of VPN Servers 120. TheServer Database 116 contains data related to server conditions which arenot limited to server location, server hub score, server time ofcreation and server load for the plurality of VPN Servers 120. Theserver conditions stored in the Server Database 116 are obtained by theProcessing Unit 114 in step 215 through the database query.

After obtaining server conditions for the plurality of VPN servers 120,the Processing Unit 114 proceeds to calculate the numerical weights. Thefollowing explanations and algorithms are some of the exemplary methodsof how the Processing Unit 114 computes the necessary numerical weights,and it may include various other mathematical methods as well.

To enable the calculation of the country weight, the API 106 forwardsthe IP address of the User device 102 to a third-party geolocationservice in order to identify the country of the User Device 102. Thethird-party geolocation services have access to several databasescontaining geolocation information for numerous IP addresses. Throughrequesting the geolocation services, the API 106 is able to receive thecountry code or in other words information regarding the country of aparticular User Device 102 is obtained. The API 106 forwards thisinformation regarding the country of the User Device 102 to the internalmemory of the Processing Unit 114. With this information the ProcessingUnit 114 is able to calculate one of the numerical weights known as thecountry weight. One must note that this information regarding thecountry of the User Device 102 is only used in the calculation of thecountry weight and is removed from the internal memory of the ProcessingUnit 114 as soon as the calculation is done.

Now, for calculating the country weight, the Processing Unit 114 assignsthe numerical value ‘1’ for all servers in the plurality of VPN Servers120 that are not located in the country of the User Device 102.Conversely, the Processing Unit 114 assigns the numerical value ‘0’ forall servers in the plurality of VPN Servers 120 that are located in thesame country as the User Device 102. With this algorithm, the serversthat are present in the same country will have lesser scores indicatingthe proximity to the User Device 102. Since this numerical weight is anindicator of the country location of the plurality of VPN Servers 120,these are termed as the country weights by the Processing Unit 114. Thereason behind identifying the nearest server is that the connectivity isfaster, and the chances of packet loss are reduced.

Next, with the hub score data, the Processing Unit 114 computes the hubweight for each server in the plurality of VPN Servers 120. This may bedone through the following exemplary mathematical expression that may beconfigured in the Processing Unit. Therefore, the hub weight may becalculated as follows:

Hub weight=−(country weight)×hub score

It is important to identify servers that are located in closer proximityto an international internet exchange hub because of reliability andspeed in connectivity. Since the country weight is an element of {1,0},the hub weight will in reality be of {−(hub score), 0}. Therefore, basedon the above algorithm, the hub weight of a server on the internationalinternet exchange hub with non-zero hub score and country weight, willbe a non-zero value as well, while for local servers the hub weightvalue will be zero regardless of hub score.

The Processing Unit 114 computes the time weight using the data relatedto the server creation time. Each server in the plurality of the VPNServers 120 has an attribute known as the time of creation or simplycreation time. In order to use this attribute, the Processing Unit 114converts the format of the creation time into Unix time format andnormalizes it by using the following expression:

T(n)=(creation time−max(creation time))/((max(creationtime)−min(creation time)))

Here, max(creation time) and min(creation time) are maximum and minimumvalues of creation of time within a given set of servers in theplurality of VPN Servers 120. With the normalized time T(n), theProcessing Unit 114 then computes time weight for each server in theplurality of VPN Servers 120 using the following exemplary expression:

Time weight=β(T(n)+κ)^(θ)+λ

Here, β is a multiplier constant, has the value of −0.15, κ is aconstant indicating the horizontal shift in creation time and has thevalue of 0.5 and λ is a constant indicating the vertical shift in thecreation time and is equal to 1. Furthermore, the exponent θ is known asthe exponential constant in time penalty and has the value of 7.Therefore, substituting the values the exemplary time weight expressionwill be:

Time weight=−(0.15)(T(n)+0.5)⁷+1

Since the domain of the normalized time T(n) is bound within theinterval {0, 1}, therefore, the range of the time weight is bound withinthe interval {1, −1.562890625}. This means that the oldest server in agiven set of the plurality of VPN Servers 120 will have a value of 1whereas, for the most recently created server the value will beapproximately −1.56. It is important to identify the servers that arecreated recently because they have less chances of being blocked andthey are more likely to work in a restricted country. This method aidsin identifying the servers that were created recently from among theplurality of VPN Servers 120.

One of the server conditions obtained from the Server Database 116 isthe information about the server load for the plurality of VPN Servers120. Each server in the plurality of VPN Servers 120 has an attributecalled load and it represents the ratio of server capacity used and thetheoretical maximum capacity of the server. Naturally, load of a serveris quite volatile over time, this means obtaining information on serverload is quite resource intensive and dynamical. However, at a particularpoint in time, the Processing Unit 114 uses the server load to computethe load weight for each of the servers in the plurality of VPN Servers120. The exemplary expression for determining load weight is as follows:

Load weight=1; if server load>overload threshold

Load weight=0; if server load≤overload threshold

Here, the overload threshold is 80, it is determined by the ServerPicker Infrastructure 110 and can be changed according to the nature andcapacity of a server and the network. Through determining the loadweight, the overload condition can be known for a particular server inthe plurality of VPN Servers 120. The logic behind this algorithm is toidentify servers that are not overloaded to service the User Device 102.One must note that the attribute of load is dynamic, and the uniquefeature of the current embodiment is that it is able to determine theload weight continuously at a regular time interval according to thechanges in the server load.

All the above calculations of determining the several numerical weightsfor each server in the plurality of VPN Servers 120 are carried out bythe Processing Unit 114 in step 217 and returns them to the ScoringEngine 112 in step 219 thereby satisfying the request made by theScoring Engine in step 211. All data necessary for computing thenumerical weights for each server are obtained from the Server Database116. However, one must note that Testing Module 118 is responsible fortesting and gathering the information related to several serverconditions. These server conditions are then stored in the ServerDatabase 116 arranged according to individual servers and later accessedby the Processing Unit 114.

The Scoring Engine 112 after receiving the necessary numerical weightsfor each server in the plurality of VPN Servers 120, it begins tocompute the server penalty score. In step 221, the server penalty scorein calculated by the following exemplary expression:

server penalty score=country weight+hub weight+time weight+loadweight+random value

That is, in order to calculate the server penalty score of a server inthe plurality of VPN Servers 120, the Scoring Engine 112 adds thedifferent numerical weights of that particular server along with therandom value. The random value is significantly a small numerical valuein the interval [0, 0.001] and is calculated by the Scoring Engine 112using the random value seed. The seed for this random value can begenerated through combining multiple attributes, server conditions, andother properties. The main purpose of the random value is to avoidcoincidences of server penalty score values. Exemplary values that areused for the random value seed may include server IDs, Unix time value,client application IDs. Here, the client application ID denotes arandomly generated number during the installation of the VPN clientapplication in the user device. Thus, the exemplary expression forgenerating the random value seed for determining the random value is asfollows:

random value seed=(server ID+client application ID+unix time)

The random value is calculated using the above generated seed by theScoring Engine 112. Therefore, the exemplary expression for calculatingthe random value is as follows:

random value=(random value seed)/1000

e.g., random value=(server ID+client application ID+unix time)/1000

After calculating the server penalty score in the above manner for eachserver in the plurality of VPN Servers 120, the Scoring Engine 112 instep 223 arranges the IP addresses of the plurality of VPN Servers 120according to the server penalty score in an ascending order. In step225, the Scoring Engine 112 identifies the optimal server form thescored list of servers. The server with the lowest server penalty scoreis the optimal server and in step 227 the Scoring engine 112 providesthe IP address of the optimal server to the API 106. In step 229, theAPI 106 forwards the IP address of the optimal server to the User Device102 and in step 231 the User Device 102 establishes the encrypted VPNconnection with the optimal server from among the plurality of VPNServers 120.

Embodiments disclosed herein relate to the field of methods and systemsfor identifying and connecting to an optimal server consistently fromamong a plurality of servers. Generally, the embodiments are related tovirtual private network (VPN) technologies featuring a dynamic logicalsystem that enables VPN applications to identify and establish aconnection with an optimal server form among the plurality of VPNservers. Moreover, the disclosure presents methods and systems forefficiently evaluating and scoring a plurality of VPN servers. However,it is to be noted that the embodiments are relatable and functionable toother like applications where there is a need for identifying an optimalserver from among a plurality of servers.

The embodiments herein may be combined or collocated in a variety ofalternative ways due to design choice. Accordingly, the features andaspects herein are not in any way intended to be limited to anyparticular embodiment. Furthermore, one must be aware that theembodiments can take the form of hardware, firmware, software, and/orcombinations thereof. In one embodiment, such software includes but isnot limited to firmware, resident software, microcode, etc. FIG. 3illustrates a computing system 300 in which a computer readable medium303 may provide instruction for performing any methods and processesdisclosed herein.

Furthermore, some aspects of the embodiments herein can take the form ofa computer program product accessible from the computer readable medium306 to provide program code for use by or in connection with a computeror any instruction execution system. For the purposes of thisdescription, the computer readable medium 306 can be any apparatus thatcan tangibly store the program code for use by or in connection with theinstruction execution system, apparatus, or device, including thecomputing system 300.

The computer readable medium 306 can be any tangible electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system(or apparatus or device). Some examples of a computer readable medium306 include solid state memories, magnetic tapes, removable computerdiskettes, random access memories (RAM), read-only memories (ROM),magnetic disks, and optical disks. Some examples of optical disksinclude read only compact disks (CD-ROM), read/write compact disks(CD-R/W), and digital versatile disks (DVD).

The computing system 300 can include one or more processors 302 coupleddirectly or indirectly to memory 308 through a system bus 310. Thememory 308 can include local memory employed during actual execution ofthe program code, bulk storage, and/or cache memories, which providetemporary storage of at least some of the program code in order toreduce the number of times the code is retrieved from bulk storageduring execution.

Input/output (I/O) devices 304 (including but not limited to keyboards,displays, pointing devices, I/O interfaces, etc.) can be coupled to thecomputing system 300 either directly or through intervening I/Ocontrollers. Network adapters may also be coupled to the computingsystem 300 to enable the computing system 300 to couple to other dataprocessing systems, such as through host systems interfaces 312,printers, and/or storage devices through intervening private or publicnetworks. Modems, cable modems, and Ethernet cards are just examples ofnetwork adapter types.

The disclosure presents a method for identifying an optimal server fromamong a plurality of VPN servers in a VPN network. The method comprisesreceiving, at a VPN service provider from a user device, request forconnection to an optimal server; obtaining, at the testing module thenecessary information about server condition that are used incalculating the server penalty score; storing, at the server databasethe information that are obtained by the testing module pertaining tothe several server condition; calculating, at the server pickerinfrastructure (SPI) the server penalty score for each server in thegiven set of VPN servers; arranging, at the server picker infrastructure(SPI) the servers according to the calculated sever penalty score;identifying, at the server picker infrastructure (SPI) the optimalserver based on the least server penalty score; sending from the serverpicker infrastructure the IP address of the identified optimal serverthrough the VPN service provider to the user device.

The method for dynamically calculating and determining the severalnumerical weights and server penalty score for each server in theplurality of VPN servers.

Although several embodiments have been described, one of ordinary skillin the art will appreciate that various modifications and changes can bemade without departing from the scope of the embodiments detailedherein. Accordingly, the specification and figures are to be regarded inan illustrative rather than a restrictive sense, and all suchmodifications are intended to be included within the scope of thepresent teachings. The benefits, advantages, solutions to problems, andany element(s) that may cause any benefit, advantage, or solution tooccur or become more pronounced are not to be construed as a critical,required, or essential feature or element of any or all the claims. Theinvention is defined solely by the appended claims including anyamendments made during the pendency of this application and allequivalents of those claims as issued.

Moreover, in this document, relational terms such as first and second,and the like may be used solely to distinguish one entity or action fromanother entity or action without necessarily requiring or implying anyactual such relationship or order between such entities or actions. Theterms “comprises”, “comprising”, “has”, “having”, “includes”,“including”, “contains”, “containing” or any other variation thereof,are intended to cover a non-exclusive inclusion, such that a process,method, article, or apparatus that comprises, has, includes, contains alist of elements does not include only those elements but may includeother elements not expressly listed or inherent to such process, method,article, or apparatus. An element preceded by “comprises . . . a”, “has. . . a”, “includes . . . a”, “contains . . . a” does not, withoutadditional constraints, preclude the existence of additional identicalelements in the process, method, article, and/or apparatus thatcomprises, has, includes, and/or contains the element. The terms “a” and“an” are defined as one or more unless explicitly stated otherwiseherein. The terms “approximately”, “about” or any other version thereof,are defined as being close to as understood by one of ordinary skill inthe art. A device or structure that is “configured” in a certain way isconfigured in at least that way but may also be configured in ways thatare not listed. For the indication of elements, a singular or pluralform can be used, but it does not limit the scope of the disclosure andthe same teaching can apply to multiple objects, even if in the currentapplication an object is referred to in its singular form.

The Disclosure is provided to allow the reader to quickly ascertain thenature of the technical disclosure. It is submitted with theunderstanding that it will not be used to interpret or limit the scopeor meaning of the claims. In addition, in the foregoing DetailedDescription, it is demonstrated that multiple features are groupedtogether in various embodiments for the purpose of streamlining thedisclosure. This method of disclosure is not to be interpreted asreflecting an intention that the claimed embodiments require morefeatures than are expressly recited in each claim. Rather, as thefollowing claims reflect, inventive subject matter lies in less than allfeatures of a single disclosed embodiment.

What is claimed is:
 1. A method, comprising: receiving a request for a virtual private network (VPN) server that is an optimal VPN server for a user device; calculating respective penalty scores for VPN servers including the optimal VPN server, wherein a respective penalty score of a VPN server is calculated based on whether the VPN server is in a same country as the user device and a proximity of the VPN server to an international Internet exchange hub; selecting the optimal VPN server based on the respective penalty scores; and transmitting an internet protocol (IP) address of the optimal VPN server to the user device.
 2. The method of claim 1, wherein the respective penalty score of the VPN server is calculated further based on a time of creation of the server.
 3. The method of claim 1, wherein the respective penalty score of the VPN server is calculated further based on a load measurement of the VPN server.
 4. The method of claim 3, the method further comprising: updating the load measurement at regular time intervals.
 5. The method of claim 1, wherein the respective penalty score of the VPN server is calculated further using an added random value that is used to avoid coincidences in the respective penalty scores.
 6. The method of claim 1, further comprising: receiving an IP address of the user device; and obtain a country of the user device using the IP address of the user device.
 7. The method of claim 1, wherein calculating the respective penalty scores for the VPN servers including the optimal VPN server comprises: obtaining respective VPN server measurements from a database, wherein the respective VPN server measurements are updated at regular intervals; and calculating the respective penalty scores using the respective VPN server measurements.
 8. A method, comprising: receiving a request for a virtual private network (VPN) server that is an optimal VPN server for a user device; calculating respective penalty scores for VPN servers including the optimal VPN server, wherein a respective penalty score of a VPN server is calculated based on a creation time of the server; selecting the optimal VPN server based on the respective penalty scores; and transmitting an internet protocol (IP) address of the optimal VPN server to the user device.
 9. The method of claim 8, wherein calculating the respective penalty score based on the creation time of the VPN server favors newly created servers.
 10. The method of claim 8, wherein the respective penalty score of the VPN server is calculated further based on whether the VPN server is in a same country as the user device and a proximity of the VPN server to an international Internet exchange hub.
 11. The method of claim 8, wherein the respective penalty score of the VPN server is calculated further based on a load measurement of the VPN server.
 12. The method of claim 11, the method further comprising: updating the load measurement at regular time intervals.
 13. The method of claim 8, wherein the respective penalty score of the VPN server is calculated further using an added random value that is used to avoid coincidences in the respective penalty scores.
 14. The method of claim 8, further comprising: receiving an IP address of the user device; and obtain a country of the user device using the IP address of the user device.
 15. The method of claim 8, wherein calculating the respective penalty scores for the VPN servers including the optimal VPN server comprises: obtaining respective VPN server measurements from a database, wherein the respective VPN server measurements are updated at regular intervals; and calculating the respective penalty scores using the respective VPN server measurements.
 16. A device comprising: a memory; and a processor, the processor configured to execute instructions stored in the memory to: receive a request for a virtual private network (VPN) server that is an optimal VPN server for a user device; calculate respective penalty scores for VPN servers including the optimal VPN server, wherein a respective penalty score of a VPN server is calculated based on whether the VPN server is in a same country as the user device and a proximity of the VPN server to an international Internet exchange hub; select the optimal VPN server based on the respective penalty scores; and transmit an internet protocol (IP) address of the optimal VPN server to the user device.
 17. The device of claim 16, wherein the respective penalty score of the VPN server is calculated further based on a time of creation of the server.
 18. The device of claim 17, wherein calculating the respective penalty score based on the time of creation favors newly created servers.
 19. The device of claim 16, wherein the respective penalty score of the VPN server is calculated further based on a load measurement of the VPN server.
 20. The device of claim 16, wherein the respective penalty score of the VPN server is calculated further using an added random value that is used to avoid coincidences in the respective penalty scores. 